Week in review: 14-20 October 2026
The government wants to narrow ESG reporting to the largest companies. Search engines are sending publishers less and less traffic. Meta's AI assistant exposed company documents through conversation links. We have gathered what you need to know from the past week and what to check on your end.
From the past week, we picked three issues that, in our view, affect companies the most. The first concerns obligations: ESG reporting in Poland is to cover only the largest enterprises. The second concerns marketing: search engines are giving websites an ever smaller share of traffic. The third concerns security: yet another AI assistant showed how easily confidential data can leave a company. Below is a factual review by area: from the labor market to start-ups.
ESG reporting is to cover only the largest companies
On Tuesday, 20 October, the Council of Ministers adopted a draft amendment to the Accounting Act. The draft implements EU Directive 2026/470, part of the Omnibus I simplification package. ESG reporting is reporting on a company's impact on the environment and society, as well as on corporate governance. It is to cover only companies and capital groups that employ more than 1,000 people and have more than PLN 1.9 billion in annual net revenue. This is equivalent to the EU threshold of EUR 450 million. The previous thresholds of the CSRD directive, that is, the EU rules on sustainability reporting, started at 250 employees and EUR 50 million in turnover.
According to the government's assumptions, described by pulsHR.pl (opens in a new tab), the obligation is to cover about 90 percent fewer companies than originally assumed. Law firms cite about 80 percent for the entire EU. This is not a contradiction. The first figure refers to the original Polish assumptions, the second to the EU estimate for the entire CSRD scope.
The draft allows trade secrets, classified information, and sensitive data to be omitted from reports. It also limits the scope of data that large companies may demand from smaller contractors in the value chain. Attestation remains at the level of limited assurance, that is, expert verification narrower than a full audit. The new rules are to apply for the first time to the financial year starting after 31 December 2026, so for companies whose financial year matches the calendar year, for 2027. The EU deadline for implementing the directive expires on 19 March 2027. Companies that reported for 2024 but fall outside the new threshold may voluntarily opt out of reports for 2025 and 2026.
For companies below the new threshold, the formal obligation is to disappear. Questions about data from large clients may remain, but in a narrower scope. The market reacted earlier than the legislator. According to Grant Thornton's report "ESG Reporting in Poland," reports for 2025 were published by 102 of 407 companies listed on the Warsaw Stock Exchange (25 percent), compared with 154 (38 percent) a year earlier.
The drop in the number of reporting companies shows how strongly ESG reporting remains dependent on regulatory obligations.
Search engines are sending publishers less and less traffic
On 15 October, analytics company Chartbeat published its report for the third quarter of 2026. In it, search engines accounted for 12 percent of pageviews among publishers in North America, compared with 21 percent a year earlier. The decline was gradual: 16 percent in the fourth quarter of 2025 and 13 percent in the second quarter of 2026. The share of search engines fell in 9 out of 10 regions. The sharpest drop was in Central Asia, from 53 to 33 percent. It rose only in Africa, from 41 to 46 percent.
The latest report does not give a cause. Earlier Chartbeat reports linked the decline to the growing role of AI in search. According to the company's broader dataset, traffic from Google Search to publishers fell by 40.2 percent year on year (July 2025 - July 2026), and from Google Discover by 34.3 percent. AI assistants are not replacing that traffic: according to Chartbeat, they account for less than 1 percent of pageviews (opens in a new tab). Small sites are losing the most. Those with 1,000 to 10,000 pageviews a day lost 60 percent of search engine traffic over two years.
These figures should be treated with caution. As Search Engine Journal (opens in a new tab) notes, the report does not say how many websites it covered or whether it is the same set as a year earlier. Chartbeat sells analytics tools to publishers. At the same time, total traffic in its network is stable: an average of 31.1 billion pageviews per month in the first seven months of 2026. Traffic from loyal readers is also stable, at about 15 billion pageviews per month. Our conclusion for companies that acquire customers through content: you need to calculate your own share of search traffic quarter by quarter and invest more heavily in direct channels such as a newsletter.
Meta's AI assistant exposed company documents
Muse, Meta's general AI assistant, has been available for about a month. Mark Zuckerberg presented it as a tool built "from the ground up for privacy and security." Researchers from Claroc showed that links to shared conversations could be found without receiving them. Each link contained the conversation title in the subdomain, and the entire pool of links worked under one domain. Such addresses end up in commercial passive DNS databases, that is, archives of domain name queries that can be searched.
Claroc found 6,800 links this way. In several hundred open conversations, the researchers found, among other things, a small company's credit application with an amount, a revenue review for a marketing company prepared for the CEO, and the annual vacation calendar for an entire team. According to Ars Technica (opens in a new tab), the researchers expected tedious work, but "one query was enough" (editorial translation). Asaf Aprozper, Claroc's co-founder, reported the issue on 8 October through Meta's bug bounty program, that is, rewards for reporting vulnerabilities, and received no response. After questions from journalists, Meta paused conversation sharing during its review.
This is not Muse's first security problem. Earlier, researcher Patrick Wardle described a vulnerability through which another app on the same device could take over the account. Muse fills out forms on its own, schedules meetings, and makes purchases, so it needs access to most of the user's accounts.
Work and jobs: wages are rising more slowly, full-time positions are shrinking
According to Statistics Poland (GUS), the average gross salary in the enterprise sector amounted to PLN 9,266.48 in September. This is an increase of 5.9 percent year on year, below market forecasts (6.1 percent). In real terms, wages rose by 1.6 percent. Employment fell by 0.8 percent, to 6,360.4 thousand full-time positions. The largest number of jobs disappeared in mining and industry, about 32.5 thousand (StockWatch.pl (opens in a new tab)).
The government's draft changes to social insurance provide that from 2027, a person on sick leave may be required to undergo treatment or rehabilitation if the prognosis indicates a return to work. Refusal would mean losing sickness benefit. The Ministry of Family, Labour and Social Policy has also sent for consultation a draft of an additional 60 days of care allowance for parents of seriously ill children. For now, we know it only from the ministry's announcement.
Volkswagen is considering freezing wages until 2030 at the 2026 level. According to estimates cited by "Süddeutsche Zeitung," the real value of salaries would fall by about 10 percent. An analysis of job offers prepared by My Company Polska, in turn, shows that "prompt engineer" has ceased to be a separate position. Employers are looking for people responsible for the entire AI system.
Marketing and sales: UOKiK changes Apple's messages
UOKiK issued a commitment decision against Apple regarding the App Tracking Transparency (ATT) mechanism, that is, pop-up windows asking for consent to tracking in apps. The messages are to be neutral and uniform, without the word "tracking" and without graphics influencing the decision. App publishers will be able to add a link to details of data processing. Apple is to implement the changes within two months of the decision becoming final. Similar decisions were previously issued in France, Italy, and Germany (Wirtualne Media (opens in a new tab)).
On 15 October, Cloudflare and OpenAI announced the results of a pilot covering about 1 percent of the Cloudflare network. Thanks to it, OpenAI was supposed to discover hundreds of millions of new pages for ChatGPT Search. According to the Cloudflare announcement (opens in a new tab), the data provided is used only to detect content, not to train models, and does not replace robots.txt settings.
Technology: European telcos seek an answer to Starlink
On 19 October, Deutsche Telekom, Orange, Telefónica, and Vodafone signed a letter of intent on jointly bidding for the 2 GHz satellite band. It is to be used for direct-to-phone satellite connectivity. Current licenses for this band expire in May 2027. A satellite partner has not yet been named. Starlink has more than 11,000 satellites in orbit (Light Reading (opens in a new tab)).
Security and privacy: stolen keys and a wave of requests to Google
OpenCode, a company that creates tools for developers, reported overnight from 16 to 17 October a breach of an older system linked to OpenCode Console. The incident affected 1.4 percent of users who had connected access keys (APIs) to OpenAI, Anthropic, or Google. The stolen keys were used for unauthorized charges, in individual cases up to about $1,700 (The Hacker News (opens in a new tab)).
Since the beginning of the year, Poles have requested the removal of 16.1 thousand URLs from Google results. In all of 2024, it was 13.8 thousand. The number of requests rose from 1,159 in July to 2,056 in September. Robert Niczewski of Bellini Market Research links this to campaigns against deepfakes led, among others, by Rafał Brzoska (Spider's Web (opens in a new tab)).
Organization management and start-ups: a big round and a Polish acquisition
On 19 October, Tenstorrent, an AI chip maker led by Jim Keller, closed a $1.5 billion round at a valuation of $6.2 billion. In December 2024, the valuation was about $2.6 billion. The round included Polish fund R+ VC. The company had previously discussed a sale with Intel and Qualcomm but chose financing (SiliconANGLE (opens in a new tab)).
Belgian Aikido Security acquired Warsaw-based start-up Cyberly. According to the parties' transaction announcement, Cyberly protected more than 300 thousand employees in more than 200 organizations, and Poland is to become a development center for the platform protecting against phishing and deepfakes. The transaction value was not disclosed. According to Crunchbase, fintech start-up funding fell in the third quarter by 21.4 percent year on year, to $10.6 billion, and the number of rounds by 31 percent. The Polish Agency for Enterprise Development (PARP) and the Industrial Development Agency (ARP) said in an announcement that the pool of loans for AI and automation implementations increased by PLN 150 million, to PLN 792 million. Loans from PLN 2.5 million to PLN 15 million are to carry interest of 0.5 percent per year.
Editor's pick
Three articles from other media outlets that we recommend:
What we are watching in the coming weeks
The ESG bill now goes to parliament. Companies below the new threshold can already plan, but we will learn the final shape of the thresholds and exclusions only after work in the Sejm. As for search traffic, we do not expect the trend to reverse. The next quarters will rather show whether the decline is slowing. In the Muse case, we are waiting for Meta's decision on how the sharing function will return. Regardless of that, companies should already now establish rules for using AI assistants that get access to corporate accounts.